Privacy Policy
This Privacy Policy explains how Checklane (“Checklane”, “we”, “us” or “our”) collects, uses, shares and protects personal data in connection with the Checklane website at checklane.sh and the Checklane service (the “Service”). Capitalized terms not defined here have the meaning given in our Terms of Service.
1. Controller and processor
Checklane as controller. We act as a controller for personal data we process to run our business and our relationship with you: account and sign-in data, billing data, communications, website analytics, and data about how the Service is used.
Checklane as processor. When our customers use the Service, we process Customer Content on their behalf, including source code, workflow definitions, logs, cache contents and any personal data contained in them. For that data, the customer is the controller and we act as a processor, processing it only on the customer’s documented instructions as set out in the Terms and, where applicable, a data processing agreement. If you are an individual whose data is in Customer Content, please contact the relevant customer to exercise your rights.
The controller is Checklane, Oesterstraat 12, 4691 KT Tholen, the Netherlands, company number 89247647 (Dutch Chamber of Commerce). You can reach us about privacy at [email protected].
2. Personal data we collect
Information you provide
- Account data: your name, email address, profile picture and organization name, and the content of messages you send us.
- Early access and invitations: the email address and details you submit when asking for access, or that a colleague enters to invite you.
Information from third parties
- GitHub account data: when you sign in with GitHub or install the Checklane GitHub App, we receive your GitHub username, user ID, name, email address and avatar, and information about the accounts, organizations and repositories on which the app is installed, as permitted by the permissions you grant.
- Google account data: if you sign in with Google, your name, email address and profile picture.
- Billing data: our payment processor, Stripe, collects your payment card details directly. We receive the billing name and address, email, tax details, the card brand, last four digits and expiry date, and payment and invoice status. We do not store full card numbers.
Information generated by use of the Service
- Workflow and job metadata: repository, workflow, run, job and step names and identifiers, branches, commit references, the user who triggered a run, statuses, timings and runner labels, as received from GitHub.
- Runner logs and metrics: resource usage of runners such as CPU, memory, disk and network, along with system and diagnostic logs produced by runners.
- Cache contents: files that workflows store in the cache, which we hold on the customer’s behalf.
- Usage and billing records: compute time per runner, plan, spend limits and credits.
- Technical data: IP addresses, browser and device information, session identifiers, and logs of requests to our website, dashboard and APIs.
- Email data: records of the transactional emails we send you and whether they were delivered.
3. How we use personal data and our legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing accounts, authenticating users, and providing the Service, including running jobs and storing caches | Performance of a contract |
| Billing, collecting payments, issuing invoices and preventing payment fraud | Performance of a contract; legal obligation |
| Sending service and transactional emails, such as sign-in, invitations, billing notices and run notifications | Performance of a contract; legitimate interests |
| Providing support and responding to requests | Performance of a contract; legitimate interests |
| Securing the Service, detecting abuse and enforcing our Terms | Legitimate interests |
| Monitoring, maintaining and improving the Service, including aggregated analytics | Legitimate interests |
| Managing the early access list and sending invitations | Consent; legitimate interests |
| Complying with legal, tax and accounting obligations, and establishing or defending legal claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before the withdrawal. We do not sell personal data, and we do not use Customer Content to train machine learning models.
4. How we share personal data
We share personal data only as described in this policy:
- Subprocessors and service providers that process data on our behalf under written agreements, listed below.
- Within your organization: members of an organization can see its members, runs, jobs and billing information, in accordance with their roles.
- Legal and safety: where required by law or legal process, or to protect the rights, property or safety of Checklane, our customers or others.
- Business transfers: in connection with a merger, acquisition, financing or sale of assets, subject to standard confidentiality obligations.
5. Subprocessors
We use the following categories of subprocessors: cloud hosting and compute, content delivery and storage, payments, email delivery, monitoring, and analytics. They currently include:
| Subprocessor | Purpose | Location |
|---|---|---|
| Stripe, Inc. | Payment processing, subscriptions and invoicing | United States, European Union |
| DigitalOcean, LLC | Hosting of the application, databases and backups | European Union (the Netherlands) |
| Cloudflare, Inc. | Content delivery, network security and cache storage | Global |
| boat.dev | Additional compute capacity for runners | European Union (Germany) |
| Amazon Web Services, Inc. (Amazon SES) | Delivery of transactional email | United States |
| Pirsch Analytics | Privacy-friendly, cookie-free website analytics | European Union |
| GitHub, Inc. | Sign-in and the source of repository, workflow and job data | United States |
| Google LLC | Sign-in, where you choose to sign in with Google | United States |
We also run part of the Service on servers we operate ourselves in third-party data centers. We will update this list before adding or replacing a subprocessor that processes Customer Content.
6. Retention
We keep personal data only for as long as necessary for the purposes described in this policy:
- Account data is kept for as long as your account exists, and deleted within a reasonable period after you delete it.
- Cache contents are deleted when they have not been used for a period set by the Service (currently seven days), when a repository exceeds its storage limit, or when the organization is deleted.
- Workflow and job metadata, runner logs and metrics are kept for as long as needed to provide the Service and its history to the customer, and are deleted when the organization is deleted.
- Billing records and invoices are kept for as long as required by tax and accounting law.
- Early access requests are kept until access is granted or you ask us to remove them.
- Server logs are kept for a limited period for security and troubleshooting.
We may keep data for longer where required by law or to establish, exercise or defend legal claims.
7. International transfers
Some of our subprocessors are located, or process data, outside the European Economic Area, the United Kingdom and Switzerland, including in the United States. Where we transfer personal data to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or a recipient’s certification under the EU-U.S. Data Privacy Framework.
8. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you and receive a copy of it;
- correct inaccurate or incomplete data;
- have your data deleted;
- restrict or object to our processing, including processing based on legitimate interests;
- receive your data in a portable format; and
- withdraw consent where processing is based on consent.
To exercise these rights, contact us at [email protected]. We may need to verify your identity before acting on a request, and will respond within the time required by law. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work, or with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
9. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, isolation of runners between jobs, and the principle of least privilege for our staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach affecting you, we will notify you and the relevant authorities as required by law.
10. Cookies
We use strictly necessary cookies to keep you signed in and to secure the sign-in process. These cookies are required for the Service to work and do not need your consent. Our website analytics are provided by Pirsch, which does not use cookies and does not track you across websites. We do not use advertising or third-party tracking cookies. Stripe may set its own cookies on pages it hosts, such as checkout, for fraud prevention.
11. Children
The Service is not directed to children, and we do not knowingly collect personal data from anyone under 16.
12. Changes to this policy
We may update this policy from time to time. We will post the updated policy on this page and update the “Last updated” date. If the changes are material, we will notify you by email or through the Service before they take effect.
13. Contact
Checklane
Oesterstraat 12, 4691 KT Tholen, the Netherlands
Company number: 89247647 (Dutch Chamber of Commerce)
Email: [email protected]